StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack
Attackers are actively attacking Magento and Adobe Commerce stores using an unpatched security flaw that lets them run their own code on your server. This can let them steal data, add malware, or take over your site.
- Report priority
- High
- Targets
- Retail
How it works
- Attackers send specially built CSS and email template files to Magento's GraphQL feature.
- The site then tries to load those files as part of a payment confirmation email.
- The malicious code hides inside the CSS and email template, then runs when the site tries to send the email.
- This lets attackers run their own commands on your server without you knowing.
What to do
Check if you run Magento or Adobe Commerce version 2.4.0 or earlier. Look in your admin panel under System > About to see your version. If it is 2.4.0 or earlier, you are affected. Also check for unusual background processes or unexpected WebSocket connections to unknown domains.
Disable the GraphQL feature in your Magento or Adobe Commerce admin panel under Stores > Configuration > Advanced > System > GraphQL until Adobe releases a patch. Scan your server for suspicious processes and connections. Contact Adobe support for guidance and monitor for unusual activity.
Technical details
Affected software: Retail
Attackers send a fake payment confirmation email template with hidden PHP code. When a store tries to send that email, the code runs on the server, letting attackers install backdoors and control the site.
A zero-day remote code execution vulnerability, tracked as OTX-6a9c7c833376c19e92778b46, affects all current versions of Magento and Adobe Commerce, including 2.4.9, without a patch. Unauthenticated attackers exploit this flaw by injecting malicious PHP code through the StyleSmuggler feature, bypassing security checks via GraphQL endpoints. The payload is later triggered through compromised payment email templates, allowing arbitrary command execution on vulnerable systems.
Active exploitation began on September 4, 2026, with attackers deploying backdoors disguised as system processes and establishing command-and-control via WebSocket over TLS and obfuscated NTP-like traffic. No official patch has been released.